Symbolic backward simulation of Java bytecode program

Abstract

We present a new method, symbolic backward simulation, for detecting bugs in Java bytecode programs. In order to find bugs comprehensively, the method determines conditions on the input side by tracing back from the tail of the program while performing reverse execution for each bytecode. Generally, reverse execution is difficult, especially for instructions of two-input-one-output operations and branches. Our method solves the problem symbolically with essentially fewer simulation cases than numerical testing and forward symbolic analysis. We also show simulation results which detected a branch condition error and a real number processing error.